Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is

Novationtec GmbH An der Schelmenhalde 35 71665 Vaihingen an der Enz Germany E-mail: contact@novationtec.com

represented by its Managing Director, Gregor Kasmann.

This policy describes which personal data is processed when you visit the public pages of authentictrust.app: the home page, the legal notice, this privacy policy and the sign-in page.

Personal data processed inside the AuthenticTrust application — user accounts, registers, documents and evidence in our customers' workspaces — is governed by the contract with the respective customer, including the data processing agreement (DPA, German: AVV) under Art. 28 GDPR. The controller of that data is the customer; Novationtec processes it as a processor.

The website and the application run on a virtual server that we rent from Contabo GmbH, Aschheimer Str. 6, 81549 Munich, Germany. The server is located in a data centre in the European Union (France). The hosting provider processes data on our behalf on the basis of a data processing agreement under Art. 28 GDPR.

The legal basis for using the hosting provider is our legitimate interest in a secure and efficient provision of the website (Art. 6 (1) (f) GDPR).

When you open a page, your browser sends data to our server for technical reasons: the IP address, date and time, the address requested, the HTTP status, the amount of data transferred, the page visited before (referrer), and the browser and operating system (user agent). This data is needed to deliver the page and is processed for the duration of the request.

We do not keep a permanent access log with IP addresses for this website. Operational and error messages of the server components are stored in the logs of the application containers and discarded when the application is updated. The hosting provider may keep its own logs to fend off attacks and to run its infrastructure securely.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and stable operation of the website).

The connection to this website is encrypted end to end with TLS (HTTPS). The server instructs browsers to use encrypted connections only (HSTS).

This website sets strictly necessary cookies only. There are no cookies for analytics, advertising or audience measurement, and therefore no cookie banner asking for consent.

• ta_lang: stores your choice of language when you click one of the flags on the home page, the legal notice or this policy. Without a click the cookie is not set, and the language follows your browser's language setting. Lifetime one year.
• ta_session: set only after you sign in; it keeps your session in the application. It is signed, inaccessible to scripts (httpOnly) and becomes invalid when you sign out, after 30 minutes of inactivity, or after 7 days at the latest. Platform administrators additionally receive a cookie for the workspace they switched to (ta_tenant), which ends with the session.

Legal basis: § 25 (2) no. 2 TDDDG (strictly necessary to provide the service you requested) and Art. 6 (1) (f) GDPR.

When you sign in on the sign-in page, your e-mail address and password are sent to the server for verification. Failed attempts are counted per account and IP address; after five failed attempts the account is locked temporarily. Security-relevant events of the account (sign-in, sign-out, lockout, changes to the account) are recorded in the application's audit log.

The legal basis is the performance of the contract with the customer for whom the account was set up (Art. 6 (1) (b) GDPR) and our legitimate interest in the security of the application (Art. 6 (1) (f) GDPR).

If you write to us by e-mail, for example via the button “Request a demo”, we process your e-mail address and the content of your message in order to answer your request. The legal basis is Art. 6 (1) (b) GDPR where the request aims at a contract, otherwise Art. 6 (1) (f) GDPR. We delete the message once it has been dealt with, unless statutory retention periods require otherwise.

This website uses no analytics or tracking services, no advertising networks, no social media plug-ins and no embedded third-party content. The Inter typeface is served from our own server, not from an external font service. When you visit the public pages, your browser connects to no server other than ours.

Inside the application, AuthenticTrust processes the data our customers create in their workspaces: user accounts with name, e-mail address and role, the registers and documents of the management system, uploaded evidence, logs and the decision trail. This data belongs to the respective customer and is never shared between workspaces. Notifications of the application (for example to invited auditors or suppliers) are sent by e-mail through an e-mail delivery provider acting on our behalf. The details — purposes, recipients, retention periods and the processors involved — are governed by the data processing agreement with the customer.

The functions of the application labelled as AI run on our own server; no data from a workspace is sent to a third-party AI service for them.

With regard to the personal data concerning you, you have the following rights against us:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
• Withdrawal of a consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise them, write to contact@novationtec.com or to the postal address above.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg) Lautenschlagerstraße 20 70173 Stuttgart Germany www.baden-wuerttemberg.datenschutz.de

We do not make decisions based solely on automated processing (Art. 22 GDPR) and do not carry out profiling.

October 2026. We update this policy when the website or the legal situation changes; the version published here applies.